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In the past couple of days both Google 1 and Apple 2 have announced that they're enabling default 
encryption on their mobile devices so that only the user possessing a device's password can access its 
local files. The public relations team at Apple makes the following claim: 

"Apple cannot bypass your passcode and therefore cannot access this data... So it's not 
technically feasible for us to respond to government warrants for the extraction of this 
data from devices in their possession running iOS 8" 

The marketing drones at Google issued a similar talking point: 

"For over three years Android has offered encryption, and keys are not stored off of the 
device, so they cannot be shared with law enforcement... As part of our next Android 
release, encryption will be enabled by default out of the box, so you won't even have to 
think about turning it on. " 

Quite a sales pitch? Cleverly disguised as a news report no less. Though it's not stated outright the tacit 
message is: open your wallet for the latest gadget and you'll be safe from Big Brother. Sadly, to a large 
degree this perception of warrant protection is the product of Security Theater aimed at rubes and 
shareholders. The anti-surveillance narrative being dispensed neglects the myriad of ways in which such 
device-level encryption can be overcome. A list of such techniques has been enumerated by John Young, 
the architect who maintains the Cryptome leak site 3 . Young asks readers why he should trust hi-tech's 
sales pitch and subsequently presents a series of barbed responses. For example: 

Because they can't covertly send your device updated software [malwarel that would 
change all these promises, for a targeted individual, or on a mass basis? 

Because this first release of their encryption software has no security bugs, so you will 
never need to upgrade it to retain your privacy? 

Because the US export control bureaucracy would never try to stop Apple from selling 
secure mass market proprietary encryption products across the border? 

Because the countries that wouldn 't let Blackberry sell phones that communicate 
securely with your own corporate servers, will of course let Apple sell whatever high 
security non-tappable devices it wants to? 

Because they want to help the terrorists win ? 



Because it's always better to wiretap people after you convince them that they are 
perfectly secure, so they'll spill all their best secrets? 

Another thing to keep in mind is that local device encryption is just that. Local. As Bruce Schneier points 
out this tactic does little to protect user data that's stored in the cloud 4 . When push comes to shove 
executives will still be able to hand over anything that resides on corporate servers. 

Marketing spokesmen are eager to create the impression that companies are siding with users in the 
struggle against mass surveillance (never mind the prolific corporate data mining 5 ). Especially after 
business leaders denied participating in the NSA's PRISM program. Yet the appearance of standing up to 
government surveillance is often a clever ploy to sell you stuff, a branding mechanism. It's important to 
recognize that Internet companies, especially billion dollar hi-tech multinationals like Yahoo 6 and Cisco 7 , 
exist to generate revenue and have clearly demonstrated the tendency to choose profits over human 
rights when it's expedient. 
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